CVE-2019-13337

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

In WESEEK GROWI before 3.5.0, the site-wide basic authentication can be bypassed by adding a URL parameter access_token (this is the parameter used by the API). No valid token is required since it is not validated by the backend. The website can then be browsed as if no basic authentication is required.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-639 CWE-863

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://gist.github.com/polkaman/d039fb5236a043907e44efc198d9161cThird Party Advisory
https://gist.github.com/polkaman/d039fb5236a043907e44efc198d9161cThird Party Advisory

Timeline

Published: Jul 9, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-133387.5In WESEEK GROWI before 3.5.0, a remote attacker can obtain the password hash of the creator of a page by leveraging wiki access to make API CVE-2019-133394.8In MiniCMS V1.10, stored XSS was found in mc-admin/page-edit.php (content box), which can be used to get a user's cookie.CVE-2019-13345.5An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information CVE-2019-133404.8In MiniCMS V1.10, stored XSS was found in mc-admin/post-edit.php via the content box. An attacker can use it to get a user's cookie. This is CVE-2019-133414.8In MiniCMS V1.10, stored XSS was found in mc-admin/conf.php (comment box), which can be used to get a user's cookie.CVE-2019-133437.5Butor Portal before 1.0.27 is affected by a Path Traversal vulnerability leading to a pre-authentication arbitrary file download. Effectivel CVE-2019-133445.3An authentication bypass vulnerability in the CRUDLab WP Like Button plugin through 1.6.0 for WordPress allows unauthenticated attackers to CVE-2019-133456.1The cachemgr.cgi web module of Squid through 4.7 has XSS via the user_name or auth parameter.CVE-2019-133466.1In MyT 1.5.1, the User[username] parameter has XSS.CVE-2019-133477.5An issue was discovered in the SAML Single Sign On (SSO) plugin for several Atlassian products affecting versions 3.1.0 through 3.2.2 for Ji CVE-2019-133488.8In Knowage through 6.1.1, an authenticated user who accesses the datasources page will gain access to any data source credentials in clearte CVE-2019-133494.9In Knowage through 6.1.1, an authenticated user that accesses the users page will obtain all user password hashes.